This vulnerability in dayrui XunruiCMS up to version 4.7.2 involves SQL injection via the groupid parameter in the group_all_edit function within the Group Editing component. An attacker can remotely exploit this flaw to inject SQL commands due to insufficient input sanitization or validation. The vendor was notified but did not respond, and no official patch or remediation has been published. The vulnerability has a CVSS 4.0 score of 5.1, indicating medium severity. Public exploit code is available, increasing the risk of exploitation.

Successful exploitation of this SQL injection vulnerability could allow an attacker with high privileges to manipulate the database via crafted input to the groupid parameter. This could lead to unauthorized data access or modification with low confidentiality, integrity, and availability impact as per the CVSS vector. No confirmed active exploitation in the wild has been reported.

No official fix or patch is currently available from the vendor, who has not responded to disclosure attempts. Users should consider restricting access to the vulnerable function or parameter, applying web application firewalls with SQL injection detection, and monitoring for suspicious activity. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.